Dynamic reuse and reconfiguration of logical data objects in a virtual tape system

ABSTRACT

An embodiment of the invention comprises a virtual tape system supporting at least one Write Once Read Many (WORM) logical tape and at least one read-write logical tape, comprising a processor configured to a first task and/or a second task. The first task initializes a new logical data object from a single pool of at least two logical data objects, with the new logical data object bound with a member of a media type group consisting of a WORM data object or a read-write data object. The second task reuses one of the logical data objects without manual ejection and reinsertion. The reuse may include the processor configured to cycle the logical data object through a scratch pool as a selected scratch logical data object and mount the selected scratch logical data object with a write from beginning of tape command to bind at least one data attribute to the WORM data object.

DOCUMENTS INCORPORATED BY REFERENCE

Commonly assigned U.S. Pat. Nos. 6,982,846 and 7,193,803 areincorporated for their showing of data storage cartridges havingrewritable media, but tamper resistant cartridge controlled write oncerecording thereof. Commonly assigned U.S. Pat. No. 6,339,810 isincorporated for treating rewritable data storage media as write once byautomatically advancing a write append limiter and operating the datastorage drive to prevent changes to the data occurring before the writeappend limiter. Commonly assigned application Ser. No. 11/697,004, U.S.Patent Application Publication 2008/0250197, provides formatting ofvirtual tape data objects with a virtual tape data object header.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The invention relates to data storage with respect to data storagesystems, and more particularly to a system for dynamic reuse of logicaldata objects.

2. Background Information

Traditionally, operating a write once read many (WORM) media relies onmedia type itself, so that a single physical data object cannot be botha standard read-write data object and a WORM enforced data object. Thesetwo media types are made mutually exclusive at manufacturing time. Whileit would be advantageous to have a common pool of physical media usedfor both WORM and read-write data object, it has not been physicallypossible based on the attributes bound to the media at manufacturingtime. One WORM attribute required of WORM media is a 12 byte World WideIdentifier (WWID) that is unique per each media cartridge created. TheWWID is used by software to tie written content on the media to a worldunique instance of that media independent of any potential labelingchanges of the data object. This allows software to detect anomalies ormalicious behavior that may result in one data object being mistaken foranother different physical media instance.

In the context of computer systems, the term “volume” is often used todescribe a single accessible data storage area with a single file systemthat is resident on a media, such as a tape of a tape drive. Asdiscussed herein, the terms “data object”, “logical object”, “logicaldata object”, and “object” are used to refer to a volume, such as a tapevolume or virtual tape volume. As is known in the art, the term volumeis used interchangeably with “tape volume”, “virtual tape volume”, tapeVOLSER (Volume Serial number), tape file volume, file volume, and filesystem.

A logical WORM environment has the same requirement for the WWID. Thelogical data objects may be inserted/created in a virtual library usingan emulated media type. Software must know the independent media poolsto direct appropriate input and/or output to the intended media pool. Itwould be advantageous if the virtual library could manage one commonmedia pool and not need separate media pools for standard read-write andlogical WORM data objects. Also, different logical WORM media dataobjects with the same data object serial number must be detectable. Forphysical tape media, each tape cartridge has the WWID generated andembedded into the cartridge at the time of manufacture independent ofits data object serial number or VOLSER. Application software honoringWORM media may use the WWID in order to detect when the physical mediahas been replaced, thus detecting potential malicious behavior. In avirtual storage system, a physical media object may not be directlyassociated with a virtual object. Instead, the virtual object may be asimple file stored in a disk subsystem. The file then has meta-dataassociated with it that can be stored in a database independent of thefile. The chain of custody patterns of the file may complicate thingssince the virtual object may be replicated and/or offloaded to multiplephysical data objects. The overall lifecycle of the virtual object mayintroduce numerous events where its contents may be compromised.

For example, an independent server may write the same data object serialnumber that may be stacked to a physical cartridge. If that physicalcartridge were to be relabeled and inserted falsely into the originalserver, its contents, including the stacked logical data object, may notbe detected as different or having changed.

Occasionally, a data object is mistakenly returned to a common pool in a‘scratch’ state. A data object, either WORM or read-write, in a scratchstate indicates that any data on the data object as expired, or isinvalid, and can be deleted, or overwritten, and the data object reusedas a new data object. For WORM data, this represents a data losscondition that is particularly undesirable. If such a mistake occurs, apreviously written WORM data object could be overwritten with non-WORMtype data or different WORM data.

SUMMARY OF THE INVENTION

The foregoing problems are solved and an advance in the art is obtainedby a novel system for dynamic reuse of logical data objects. The systemincludes a virtual tape server supporting at least one Write Once ReadMany (WORM) logical data object and at least one read-write logical dataobject. In one embodiment, the virtual server comprises a processorconfigured to initialize a logical data object from a common pool of atleast two logical data objects. The logical data object is bound with amember of a media type group in response to a write command to beginningof logical data object to replace any information previously associatedwith the logical data object. The media type group members comprise aWORM logical data object and a read-write logical data object. Theprocessor is configured to reuse one of the logical data objects as themember of the media type group without ejection and reinsertion bymounting the logical data object with a write from beginning of logicaldata object to bind at least one data attribute to the member of themedia type group to replace any previous attribute and data associatedwith the logical data object.

Further, in one embodiment, the processor is configured to select one ofthe WORM logical data objects for reuse as a new WORM logical dataobject. The processor maintains data attributes bound to the selectedWORM logical data object until it is determined that the selected WORMlogical data object is available for reuse. The processor assigns atleast one temporary data attribute to the selected WORM logical dataobject while maintaining the data attributes bound to the selected WORMlogical data object. The temporary data attribute enables the processorto validate, by determining that the data stored on the WORM logicaldata object has expired, or is no longer valid, that the selected WORMlogical data object can be reused as a new WORM logical data object or anon-WORM logical data object. The processor mounts the selected WORMlogical data object and if validated by the server, receives a writecommand from beginning of logical data object to bind at least one dataattribute to the selected WORM logical data object to replace dataattributes and data associated with the selected WORM logical dataobject to reuse the selected WORM logical data object as the new WORMlogical data object.

In another embodiment, a method for operating a virtual serversupporting at least one Write Once Read Many (WORM) logical data objectand at least one read-write logical object. The method comprisesinitializing a logical data object from a common pool of the logicaldata objects, the logical data object bound with a member of a mediatype group in response to a write command to beginning of logical dataobject to replace the any information previously associated with thelogical data object. The member of the media type group comprises a WORMlogical data object and a read-write logical data object. Reusing one ofthe logical data objects as the member of the media type group withoutejection and reinsertion by mounting the logical data object with awrite from beginning of logical data object to bind at least one dataattribute to the member of the media type group to replace any previousattribute and data associated with the logical data object.

In another embodiment, a computer program product that comprises acomputer usable medium having computer usable program code embodiedtherewith. The computer usable program code is configured to operate aprocessor to operate a virtual server configured to support at least oneWrite Once Read Many (WORM) logical data object and at least one read-write logical data object. The computer usable program code is furtherconfigured to initialize the logical data object from the common pool ofthe logical data objects, with the logical data object bound with amember of a media type group in response to the write to the beginningof the logical data object to replace the any information previouslyassociated with the logical data object. The member of the media typegroup consisting of a WORM data object and a read-write data object. Thecomputer usable program code is further configured to reuse one of thelogical data objects as the member of the media type group withoutejection and reinsertion by mounting the logical data object with awrite from beginning of the logical data object to bind at least onedata attribute to the member of the media type group to replace anyprevious attribute and data associated with the logical data object.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagrammatic illustration of a virtual server that may beembodied in the systems of FIGS. 7 to 8;

FIG. 2 is a diagrammatic illustration of media type group members;

FIGS. 3 to 5 are flowcharts of various operations of the virtual server;

FIG. 6 is an isometric view of a removable data storage cartridge with amedia, such as magnetic tape, and with a cartridge memory shown inphantom;

FIG. 7 is a diagrammatic illustration of information of a logical dataobject;

FIG. 8 is a diagrammatic illustration of a data storage system which mayimplement the invention; and

FIG. 9 is a diagrammatic illustration of a server of the data storagesystem of FIG. 8.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

This invention is described in preferred embodiments in the followingdescription with reference to the Figures, in which like numbersrepresent the same or similar elements. While this invention isdescribed in terms of the best mode for achieving this invention'sobjectives, it will be appreciated by those skilled in the art thatvariations may be accomplished in view of these teachings withoutdeviating from the spirit or scope of the invention.

The foregoing problems are solved and an advance in the art is obtainedby a novel system for dynamic reuse of logical data objects. The systemincludes a virtual tape server supporting at least one Write Once ReadMany (WORM) logical data object and at least one read-write logical dataobject. In one embodiment, the virtual server comprises a processorconfigured to initialize a logical data object from a common pool of atleast two logical data objects. The logical data object is bound with amember of a media type group in response to a write command to beginningof logical data object to replace any information previously associatedwith the logical data object. The media type group members comprise aWORM logical data object and a read-write logical data object. Theprocessor is configured to reuse one of the logical data objects as themember of the media type group without ejection and reinsertion bymounting the logical data object with a write from beginning of logicaldata object to bind at least one data attribute to the member of themedia type group to replace any previous attribute and data associatedwith the logical data object.

As a general, systematic overview, the virtual server may include amanagement interface where policy based construct definitions can beconfigured. As the virtual server, or an external host (not shown),mounts logical data objects, constructs are provided stating how thesystem should manage data of the logical data objects. Rules aredefined, through indirection for example, via the management interface.The rules determine if the mounted logical data object should be treatedas Write Once Read Many (WORM) or read-write.

If a selected logical data object is to be configured as WORM, atemporary data attribute, such as temporary World Wide Identifier(WWID), is generated and provided to the server during the mount. If theserver accepts the selected logical data object, a first write commandto beginning of logical data object will occur. At this time, the WWIDis bound to the logical data object and retains its WORM attributes. Ifthe logical data object was previously a WORM logical data object, itsdata and previous WWID is atomically overwritten at this time, whichsimulates an eject and re-insertion of different media with the sameVOLSER (Volume Serial number). While the logical data object is mounted,the virtual server will move the logical data object out of a scratchpool and into a private pool to prevent circular reuse of the logicaldata object.

When a read-write or WORM logical data object is believed to no longerhave valid content with respect to the host, all data stored on thelogical data object has expired, the virtual server will move thelogical data object from the private pool to a common scratch poolcomprising both WORM and read-write logical data objects. This allowsthe logical data object to again be a candidate for future mounts andreuse. Future mounts can then re-bind the logical data object as eitherread-write or WORM.

It is valuable to retain the logical data object type (WORM orread-write) and data attributes, such as WWID, until first write, sinceit allows the virtual server processing the mount to reject the selectedlogical data object, thus leaving the logical data object's previousdata and data attributes unmodified. For example, a logical data objectmay have inadvertently been moved into a scratch pool, then selected fora scratch mount. The virtual server determines that the selected logicaldata object was inadvertently moved into a scratch pool and the selectedlogical data object contains valid or unexpired data. The virtual serverthen fails the mount operation and the unexpired or valid data, alongwith the media type, either WORM or read-write, is maintained.Simultaneously, the virtual server moves the selected logical dataobject back into a protected private pool, which prevents any of theexisting WORM protected data on the selected logical data object frombeing lost.

Additionally, the virtual server may inadvertently move a selectedlogical data object into a scratch pool and then move it back to aprivate pool before it is reused. This moving of a logical data objectfrom a private pool to a scratch pool, and then back to the private pooldoes not cause any loss of the WORM protected data on the selectedlogical data object. Only when a reuse of a selected logical data objectoccurs, where a write command from beginning of logical data object isissued, will any existing data and data attributes associated with theselected logical data object overwritten and any previous data betruncated.

In summary, embodiments of the virtual server are configured to protectprevious WORM objects even though they have been made available forreuse, such as by indicating that the data on the logical data object isinvalid, and placing them in a state which allows reversal of thedecision by the processor. With respect to WORM data objects, there arerequirements that must be met to protect the data object against beingmodified or overwritten. There is no requirement to protect the previousWORM object from destruction. Whether the object is to be made a newWORM or whether it is to be made a read/write, the reuse is held untilthe host indicates it is ready to write at Beginning of Logical dataobject, referred to in the art as “Beginning of Tape” (BOT), whichindicates that the host agrees with the reuse. At that point, all thedata of the WORM, and associated information such as the previous WWID,are deleted, and the logical object is assigned a new WWID and bound asa WORM or is made a read/write object.

Referring to FIGS. 1 to 8, a virtual server 100 may include a processor102, which may include a hierarchical storage node 60 and avirtualization node 40 (both shown in FIG. 8) that may be configured tooperate in the virtual server 100, based upon the following description.

In one embodiment, the virtual server 100 supports at least one WriteOnce Read Many (WORM) logical data objects 108 and at least oneread-write logical data object 109 that reside in a common pool 106. Aprocessor 102 is configured to initialize a new logical data object 104from the common pool 106 of at least two logical data objects 108 and109. The new logical data object 104 is bound with a media type groupmember 110 in response to a write command to beginning of the logicaldata object 114, i.e. a write beginning of tape (BOT) command, toreplace any information previously associated with the logical dataobject 107. The information previously associated with the logical dataobject 107 may include a previous World Wide Identifier (WWID) 115,media type (such as WORM or read-write) 116, write mount count 118 andattributed content 113. The new logical data object is bound with amember of a media type group comprising a WORM data object 120 and aread-write data object 122 as shown in FIG. 2. The processor 102 isconfigured to reuse one of the logical data objects 107 as the mediatype group member 110 without ejection and reinsertion by mounting thelogical data object with a write from beginning of the logical dataobject to bind at least one data attribute 112 to the media type groupmember 110 to replace any previous attribute 112, 115, 116, 118 and data113 associated with the logical data object 107.

The processor 102 may further be configured to utilize a logical dataobject 107 from the common pool 106 as the new logical data object 104with its previous data object serial number 114, a previous data objectlogical media type 116 and a previous write mount count 118. Theprocessor 102 generates a new World Wide Identifier (WWID) 119 for thenew logical data object 104 that is probabilistically non-repeatable.The processor 102 may be configured to bind the new WWID 119 and themedia type group member 110 to a logical data object 107 to create thenew logical data object 104, thereby replacing a previous WWID 115, aprevious media type 116 and a previous write mount count 118 in responseto a write from the beginning of the object 114. The previous writemount count 118 may be reset when the new WWID 119 and the media grouptype member 110 are bound to the logical data object 107 to create thenew logical data object 104. The new WWID 119 is bound at first writefrom beginning of the object command 114 replaces any previous mediatype 116 while removing any previously associated data 113. Until thenew WWID 119 and media type group member 110 have been bound to the newlogical data object 107, the previous WWID 115, the previous media type116, the previous write mount count 118 and any previous associated data113 may still be retrieved from the logical data object 107.

The processor 102 may be configured to respond to mounting a data object103 with an anticipated write from load point to use the data object asthe logical data object 107 to create the new logical data object 104.

The processor 102 operates the virtual server 100 by responding to amount of the data object 103 with an anticipated write from load pointby using the data object 103 as the logical data object 107 to createthe new logical data object 104. The processor 102 may be configured toreset the write mount count 118 when the new WWID 119 and the media typegroup member 110 are bound to the new logical data object 104. Theprocessor 102 cycles the WORM logical data object 108 through the commonpool 106 as a selected scratch logical data object 107 with the commonpool comprising scratch logical data objects that may include a WORMlogical data object 108 and a read-write logical data object 109. Reuseof the selected scratch logical data object 107 occurs only upon theprocessor cycling the selected scratch logical data object through thescratch pool 106.

In one embodiment, the invention includes an exemplary method foroperating a virtual server 100 supporting at least one Write Once ReadMany (WORM) logical data objects 108 and at least one read-write logicalobjects 109. The method includes the steps of initializing a new logicaldata object 104 from a common pool 106 of at least two logical dataobjects 108 and 109. The new logical data object 104 bound with themedia type group member 110 in response to a write to beginning of thelogical data object 114 to replace any information 112, 113, 115, 116and 118 previously associated with the logical data object 107. One ofthe logical data objects 104 is reused as the media type group member110, without ejection and reinsertion by mounting the logical dataobject 107 with a write from beginning of the logical data object 114 tobind at least one data attribute 112 to the media type group member 110to replace any previous attribute 115, 116 and 118 and data 113associated with the logical data object 107.

In another exemplary embodiment, the invention comprises a computerprogram product that comprises a computer usable medium having computerusable program code embodied therewith. The program code is configuredto operate the processor 102 to operate the virtual server 100 tosupport at least one WORM logical data object 108 and at least one read-write logical data object 109, to initialize the new logical data object104 from the common pool 106 of at least two logical data objects 108and 109, the new logical data object 104 bound with the media type groupmember 110 in response to a write to beginning of the logical dataobject 114 to replace any information 113, 115, 116 and 118 previouslyassociated with the logical data object 107. The logical data object isbound with the media type group 110 and to reuse one of the logical dataobjects 107 as the media type group member 110 without ejection andreinsertion by mounting the logical data object 107 with a write frombeginning of the logical data object 114 to bind at least one dataattribute 112 to the media type group member 110 to replace any previousattribute 112, 115, 116, 118 and data 113 associated with the logicaldata object 117.

FIGS. 3 to 5 show exemplary flowcharts of the operations of theprocessor 102 as steps that may be implemented as program instructions.Referring to FIG. 3, an exemplary flowchart of program instructions foroperating the processor 102 to operate the virtual server 100 is shown.Step 130 operates the processor 102 to operate as the virtual server 100supporting at least one WORM logical data object 108 and at least oneread-write data object 109. Step 132 initializes the new logical dataobject 104 from the common pool 106 with the new logical data objectbound with the medium type group member 110. Step 134 reuses one of thelogical data objects 104 as the media type group member 110. Step 136mounts the logical data object 104 with a write from beginning of objectcommand 114 to bind the at least one data attribute 112 to the mediatype group member 110.

FIG. 4 shows a flowchart refining the example of program instructions130 and in particular 132 of FIG. 3 for operating the processor 102 tooperate the virtual server 100 as follows: Step 138 utilizes a logicaldata object 107 from the common pool 106 as the new logical data object104 with its previous data object WWID 115, a previous data objectlogical media type 116 and a previous write mount count 118. Step 140generates a new World Wide Identifier (WWID) 119 for the new logicaldata object 104 that is probabilistically non-repeatable. Step 142 bindsthe new WWID 119 and the media type group member 110 to the logical dataobject 107 to create the new logical data object 104, thereby replacingthe previous WWID 115, the previous media type 116 and the previouswrite mount count 118.

FIG. 5 shows a flowchart refining the example of program instructions130 and in particular 134 of FIG. 3 for operating the processor 102 tooperate the virtual server 100 as follows: Step 150 responds to a mountof the data object 103 with an anticipated write from load point byusing the data object as the logical data object 107 to create the newlogical data object 104. Step 152 resets the write mount count 118 whenthe new WWID 119 and the media type group member 110 are bound to thenew logical data object 104. Step 154 cycling the WORM logical dataobject 108 through the common pool 106 as a selected scratch logicaldata object 107 with the common pool comprising scratch logical dataobjects that may be a WORM logical data object 108 or a read-writelogical data object 109. Reuse of the selected scratch logical dataobject 107 occurs only upon the processor cycling the selected scratchlogical data object through the scratch pool 106.

The implementations may involve software, firmware, micro-code, hardwareand any combination thereof. Referring to FIG. 9, the implementation maytake the form of code or logic implemented in a medium, such as memory,storage and circuitry of hierarchical storage node 60, where the mediummay comprise hardware logic (e.g. an integrated circuit chip,Programmable Gate Array [PGA], Application Specific Integrated Circuit[ASIC], or other circuit, logic or device), or a computer readablestorage medium, such as a magnetic storage medium (e.g. an electronic,magnetic, optical, electromagnetic, infrared, or semiconductor system,semiconductor or solid state memory, magnetic tape, a removable computerdiskette, and random access memory [RAM], a read-only memory [ROM], arigid magnetic disk and an optical disk, compact disk-read only memory[CD-ROM], compact disk-read/write [CD-R/W] and DVD).

Referring to FIG. 6, an example of a data storage cartridge 10, such asa magnetic tape cartridge, is illustrated which comprises a rewritablemagnetic tape 11 wound on a hub 12 of reel 13, and a cartridge memory14. One example of a magnetic tape cartridge comprises a cartridge basedon LTO (Linear Tape Open) technology. The cartridge memory (CM) 14, forexample, comprises a transponder having a contactless interface, whichis retained in the cartridge 10, for example, by being encapsulated bythe cartridge when it is assembled, as is understood by those of skillin the art. The illustrated magnetic tape cartridge is a single reelcartridge. Magnetic tape cartridges may also comprise dual reelcartridges in which the tape is fed between reels of the cartridge. Themagnetic tape 11 is typically arranged to store a large number of dataobjects of data.

One requirement of WORM media is that different instances of media withthe same data object serial number must be detectable to protect theintegrity of the data against possible malicious behavior. Where theWORM media or media treated as though it were WORM is in a physicalmedia object, a world wide name embedded in the media cartridge 10 maybe employed to detect when the physical media has been replaced, thusdetecting potential malicious behavior.

Data is not always stored on a physical media 11 whose replacement in aphysical cartridge 10 can be detected. Rather, data storage systems maystore data in different forms, such as logical or virtual data, and anexample of such a system is illustrated in the data storage system 20 ofFIG. 8. Herein, data may be organized in any of various forms, called“data objects” or “objects”, the terms chosen without reference to anyparticular size or arrangement of data.

Referring to FIGS. 8 and 9, the data storage system 20 provides storagefor a plurality of host systems 18, 19. The data storage system 20, inone embodiment, employs four (4) virtual tape server clusters 30interconnected by a network 80 with each cluster 30 including avirtualization node (“VN”) 40 and a disk storage (“DK”) 50 for emulatinga tape drive or tape library to hosts 18, 19. Each cluster furthercomprises a hierarchical storage node (“HSN”) 60 for locally moving databetween disk storage 50 and an automated tape library (“ATL”) 70 as wellas remotely moving data between a local disk storage 50 and a remotedisk storage. Examples of disk storage comprise one or more disk drives,for example, arranged as a redundant array of independent disks (RAID)or just a bunch of disks (JBOD), or solid state disk (SSD), etc. Herein,a data storage system having both disk storage 50 and an automated tapelibrary 70 is called a “composite library”.

The disk storage 50 may serve as a virtual data object cache containinglogical data objects that emulate data objects that may be stored on themagnetic tape 11 of FIG. 6. Still referring to FIGS. 8 and 9, thelogical data objects may stored by disk storage 50 for local and remoteaccess thereto, and library 70 comprises at least one robotic accessor72 for mounting physical tape cartridges 10 in physical tape drives 73for access to data objects stored in the physical tape cartridges 10. Tothis end, virtualization node 40 may employ a pair of tape daemons 41and 42 for operating on virtual data object files residing in eitherlocal cache disk storage 50 or a remote cache disk storage as directedby a host system 18, 19, and a hierarchical storage node 60 may employ acluster manager 61, a remote file access server 62, a data mover 63, aphysical tape manager 64, a cache manager 65, a recall manager 66, adatabase 67, a management interface 68 and a media manager 69.

Cluster manager 61 may coordinate operations between clusters 30 viaintercluster tokens that are stored in each cluster's database 67 todetermine which cluster 30 has a current copy of data and coordinatescopying of data between clusters. Remote file access server 62 mayprovide a link to cache disk storage 50 by a remote cluster. Data mover63 may control the actual data transfer operations for copies performedbetween clusters 30 and transfers of data between cache disk storage 50and library 70.

Physical tape manager 64 may manage physical tape data objects inlibrary 70 in multiple physical data object pools, controls reclamation,borrows/returns data objects from a scratch pool, and controls movementof physical tape cartridges 10 and the data objects between pools. Cachemanager 65 may control a copying of data objects between cache diskstorage 50 to library 70 and any subsequent removal of a redundant copyof data in cache 50, and may provide control signals to balance dataflow between cache disk storage 50 and other node 60 components. Recallmanager 66 may queue and control recalls of data into cache data storage50 from library 70 on behalf of virtualization node 40 and clustermanager 61.

Management interface 68 may provide information about virtual tapeserver cluster 30 and may allow a user control and configuration ofcluster 30. Media manager 69 may manage the handling of physical tapecartridges 10 and error recovery, and diagnoses errors and determines ifthe errors were caused by a physical tape drive 73 of library 70 or aphysical tape media 11 to thereby take appropriate action.

An example of a data storage system 20 that may implement the presentinvention is discussed in the incorporated '004 Application, and anotherexample includes the IBM® TS7700 Virtual Tape Server.

Referring to FIG. 7, a logical data object or data object 80 comprisesdata arranged to emulate a data object or data object physicallyrecorded on a magnetic tape 11. A magnetic tape 11 may be organized inmany ways. Typically, a magnetic tape is arranged with parallel tracks,and may also be arranged with several parallel wraps of groups ofparallel tracks. In one example, the magnetic tape is movedlongitudinally in a first direction while a tape head system reads andwrites data with respect to one wrap, and is reversed to be moved in theopposite direction and the tape head system is shifted to another wrap.A disk drive, in contrast, typically comprises data that is recorded ina serial fashion and is read and written by a single head on the surfaceof a rotating disk. Thus, the data of a disk drive is typicallyrearranged to a format that matches that of a magnetic tape, and addsinformation related to the magnetic tape, in order to emulate the dataof the magnetic tape.

Typical constructs include a header 81 at the beginning of the dataobject or object, followed by user data 83. A trailer 88, such as at theend of the data object or object, may indicate the end of a file withinthe data object or object and, for example, comprises a filemark 89, andthe end of the data object or object may comprise a number of additionalfilemarks 90 and an end of data marker 91.

Operations involving access to logical data objects that are emulatingmagnetic tape require that the data first be “mounted”, to emulateloading and mounting of a magnetic tape in a magnetic tape drive, calledherein a logical mount.

In the field of cryptography, a cryptography checksum hash is difficultto reproduce when it derives from a modified payload of data. If apayload is maliciously modified, it will be near impossible for theresulting checksum hash that is regenerated to match the originallygenerated checksum hash. The goal of the present invention is to producea checksum value that is just as unlikely to be reproduced. However, thepayload is not being protected, but, by using nonce fields, the payloadis being manipulated to produce a value that is highly unlikely to everbe reproduced. For example, the use of a field that is never likely tooccur a 2nd time in the payload, such as the timestamp, makes theresulting checksum hash even more unlikely to be produced a second time.Such a resulting checksum can be used as a unique WORM identifier. Withappropriate nonce fields, a checksum can result in a 12 byte World WideIdentifier (WWID) that is unique for an instance of a WORM logical dataobject as previously described.

Once the unique WORM identifier is generated and bound to the dataobject, no algorithm is likely to exist that can identically create thesame identifier for the given data object or data object. The uniqueWORM identifier is one that is probabilistically insignificantlyunlikely to be regenerated for the some VOLSER within the same server orlibrary, or any server or library in the world. There is an assumptionthat if a malicious person was capable of modifying the fields which areused for the payload, then that person has already breached numeroussecure interfaces, including direct access to the raw data the checksumhash is attempting to protect in the first place. Therefore, therobustness of the algorithm mainly focuses on unexpected checksum hashcollisions in order to leverage or detect flaws in the algorithm itself.

Additional protection comprises maintaining a write-mount count withrespect to the logical data object in the header 81, for example as atoken, and maintaining the write-mount count in the persistent database67. The control 60, in order to allow the logical data object 80 to beaccessed externally to the control, additionally requires thewrite-mount count of the header to be either equal to or greater by avalue of one than the write-mount count of the persistent database.

In one example, the control 60 is configured to increment thewrite-mount count each time the logical data object is logically mountedand data is correctly appended to the logical data object. Attempts atincorrect appending of the WORM data will likely cause WORM handlingerrors to occur. An example of a method to append data to existing WORMdata is discussed in the incorporated '810 patent.

Further, where the logical object is characterized by the control as amagnetic tape object, emulating a magnetic tape data object or object,the write-mount and the external access each comprises a logical mountof a logical magnetic tape cartridge, as discussed above.

The reason for having the write-mount count of the header to be eitherequal to or greater by a value of one than the write-mount count of thepersistent database, is to account for any append failure where thedevice/server/system experiences a failure after the write-mount countis updated for the database 67, but before the header 81 is updated.

Upon a logical mount, if all 12 bytes of the database unique WORMidentifier token and the header are not identical, the mount operationfor the logical data object is failed, for example, with a mountcompletion error code. Even if the unique WORM identifier token of thedatabase and the header match, but the write-mount count of the headeris not either equal to or greater by a value of one than the write-mountcount of the persistent database, the mount operation will also failwith an error code. An override may be provided to account for anunexpected and non-malicious situation, such as during a datarestoration procedure.

The database 67 is maintained to be persistent by preventingunintentional overwrite of at least the portion of the databasecontaining the unique WORM identifiers and write-mount counts associatedwith the logical identifiers of the integrity protected logical dataobjects.

In order to provide integrity of the WORM data for the data storagesystem 20 or composite library, the unique WORM identifiers andwrite-mount counts are synchronized between each of databases 67 foreach of the clusters 30, for example, via network 80. Thus, if a WORMlogical data object is transferred from one disk storage 50 or library70 in one cluster, to a disk storage 50 or library 70 in anothercluster, either via the network 80 or by transfer of a physical tape 10,the database 67 for that cluster will also provide data integrity withrespect to the WORM logical data object, thereby providing dataintegrity for the entire storage system 20.

As discussed above, the overall lifecycle of a logical data object 80,both as stored in a server and on a physical media, may introducenon-protected places where its contents can be compromised. For example,another independent server may write data with the same data objectserial number that can get stacked to a different physical tapecartridge. If that physical cartridge were to be relabeled and insertedfalsely into the original server, its contents, including the stackedlogical data object, may go undetected as different. Further, it may bepossible that microcode issues may introduce race or data anomalieswhere logical data objects may be replaced with stale versions.

Referring to FIGS. 8, 9 and 7, a control, such as hierarchical storagenode 60, is configured to protect the integrity of data, such as a WORMlogical data object, against possible malicious behavior by assigning anunique WORM identifier to a logical data object, and to store the uniqueWORM identifier as associated with the logical identifier, in adatabase, such as database 67, maintained by the control so as to bepersistent. Data storage, such as virtualization node 40, disk datastorage 50, or library 70, is configured to write the logical dataobject 80, identified by the logical identifier, together with a header81 with the unique WORM identifier. The control 60, in order to allowthe logical data object to be accessed externally to the control,requires matching the unique WORM identifier in the header 81 of alogical data object 80 to the unique WORM identifier of the persistentdatabase 67 for the logical object.

The database 67 may comprise the metadata with respect to the logicaldata object, and the unique WORM identifier for a logical data object isstored with the metadata for the logical data object. In one example,the logical identifier of the logical data object is a data objectserial number or “VOLSER”. In one example, the unique WORM identifier isthe same length as a WWN (World Wide Name), for example, of 12 bytes.

In order to be “unique”, the unique WORM identifier WWN is generated soas to be probabilistically unlikely to be generated twice for the sameVOLSER. In one embodiment, the unique WORM identifier is formed of achecksum hash value related to nonce (numbers used once) fieldscomprising at least the logical identifier (VOLSER) of the logical dataobject, an incrementing token, and a time stamp. The checksum hash valuemay, for example, comprise a cryptography checksum hash of greater than12 bytes, of which the least significant bits are truncated to leave theleftmost significant bits. A specific example comprises a“Message-Digest 5 (MD5)” cryptography checksum 128 bit hash, which istruncated to 96 bits.

Once the unique WORM identifier is generated and bound to the dataobject, no algorithm is likely to exist that can identically create thesame identifier for the given data object or data object. The uniqueWORM identifier is one that is probabilistically insignificantlyunlikely to be regenerated for the some VOLSER within the same server orlibrary, or any server or library in the world. There is an assumptionthat if a malicious person was capable of modifying the fields which areused for the payload, then that person has already breached numeroussecure interfaces, including direct access to the raw data the checksumhash is attempting to protect in the first place. Therefore, therobustness of the algorithm mainly focuses on unexpected checksum hashcollisions in order to leverage or detect flaws in the algorithm itself.

Those skilled in the art will appreciate that various adaptations andmodifications of the just-described preferred embodiments can beconfigured without departing from the scope and spirit of the invention.Therefore, it is to be understood that, within the scope of the appendedclaims, the invention may be practiced other than as specificallydescribed herein.

1. A virtual server supporting at least one Write Once Read Many (WORM)logical data object and at least one read-write logical data object, thevirtual server comprising: a processor configured to initialize alogical data object from a common pool of at least two logical dataobjects, said logical data object bound with a member of a media typegroup in response to a write command to beginning of logical data objectto replace any information previously associated with said logical dataobject, said media type group members comprising a WORM logical dataobject and a read-write logical data object; and said processorconfigured to reuse one of said logical data objects as said member ofsaid media type group without ejection and reinsertion by mounting saidlogical data object with a write from beginning of logical data objectto bind at least one data attribute to said member of said media typegroup to replace any previous attribute and data associated with saidlogical data object.
 2. The virtual server of claim 1, furthercomprising: said processor configured to select one of said WORM logicaldata objects for reuse as a new WORM logical data object, said processormaintaining data attributes bound to said selected WORM logical dataobject until it is determined that said selected WORM logical dataobject is available for reuse; said processor assigning at least onetemporary data attribute to said selected WORM logical data object whilemaintaining said data attributes bound to said selected WORM logicaldata object; and said processor mounting said selected WORM logical dataobject and receiving a write command from beginning of logical dataobject to bind at least one data attribute to said selected WORM logicaldata object to replace data attributes and data associated with saidselected WORM logical data object to reuse said selected WORM logicaldata object as said new WORM logical data object.
 3. The virtual serverof claim 2, further comprising: said processor configured to select oneof said WORM logical data objects for reuse as a new read-write logicaldata object, said processor maintaining data attributes bound to saidselected WORM logical data object until it is determined that saidselected WORM logical data object is available for reuse; said processorassigning at least one temporary data attribute to said selected WORMlogical data object while maintaining said data attributes bound to saidselected WORM logical data object; and said processor mounting saidselected WORM logical data object and receiving a write command frombeginning of logical data object to remove data attributes and dataassociated with said selected WORM logical data object to reuse saidselected WORM logical data object as said new read-write logical dataobject.
 4. The virtual server of claim 2, further comprising: saidprocessor configured to select one of said read-write logical dataobjects for reuse as a new WORM logical data object, said processormaintaining data associated with said selected read-write logical dataobject until it is determined that said selected read-write logical dataobject is available for reuse; said processor assigning at least onetemporary data attribute to said selected read-write logical data objectwhile maintaining said data associated with said selected read-writelogical data object; and said processor mounting said selectedread-write logical data object and receiving a write command frombeginning of logical data object to bind at least one data attribute tosaid selected read-write logical data object to replace data associatedwith said selected read-write logical data object to reuse said selectedread-write logical data object as said new WORM logical data object. 5.The virtual server of claim 2, further comprising: said at least onetemporary data attribute assigned to said selected WORM logical dataobject provided to said processor during said mounting of said selectedWORM logical data object; said processor determining if said selectedWORM logical data object is available for reuse as said new WORM logicaldata object by issuing said write command to beginning of logical dataobject; and if said write command to beginning of logical data object isnot issued, said data associated with said selected WORM logical dataobject and said data attributes bound to said WORM logical data objectare retained and said temporary data attributes are discarded.
 6. Thevirtual server of claim 1, wherein said common pool comprises scratchlogical data objects, said scratch logical data objects comprising atleast one WORM logical data object and at least one read-write logicaldata object.
 7. The virtual server of claim 6, wherein reuse of saidlogical data object can only occur if said logical data object isselected from a pool of scratch said logical data objects or if saidlogical data object is a logical data object that is newly inserted inthe virtual server.
 8. The virtual server of claim 6, wherein saidprocessor is configured to cycle said WORM logical data object throughsaid scratch pool as a selected scratch logical data object.
 9. Thevirtual server of claim 7, wherein reuse one of said scratch logicaldata object occurs only in response to said processor cycling saidscratch logical data object through said scratch pool as a selectedscratch logical data object.
 10. The virtual server of claim 7, whereinsaid scratch logical data object is moved to a said pool of scratchlogical data objects only if said processor has determined that the datastored thereon has expired and said scratch logical data object isavailable for reuse.
 11. The virtual server of claim 1, wherein saidprocessor further comprises: said processor configured to reuse one ofsaid logical data objects as said member of said media type groupwithout ejection and reinsertion.
 12. The virtual server of claim 1,further comprising a memory configured for storing instructions operablewith said processor, said instructions comprising: operating saidprocessor to operate said virtual server with said at least one WORMlogical data object and at least one read-write logical data object;initializing said logical data object from said common pool of saidlogical data objects, with said logical data object bound with saidmember of said media type group in response to said write command tosaid beginning of logical data object; and reusing one of said logicaldata objects as said member of said media type group without ejectionand reinsertion by mounting said logical data object with a write frombeginning of logical data object to bind at least one data attribute tosaid member of said media type group to replace any previous attributeand data associated with said logical data object.
 13. A method foroperating a virtual server supporting at least one Write Once Read Many(WORM) logical data object and at least one read-write logical object,the method comprising the following steps: initializing a logical dataobject from a common pool of said logical data objects, said logicaldata object bound with a member of a media type group in response to awrite command to beginning of logical data object to replace said anyinformation previously associated with said logical data object, saidmember of said media type group comprising a WORM logical data objectand a read-write logical data object; and reusing one of said logicaldata objects as said member of said media type group without ejectionand reinsertion by mounting said logical data object with a write frombeginning of logical data object to bind at least one data attribute tosaid member of said media type group to replace any previous attributeand data associated with said logical data object.
 14. The method ofclaim 13, further comprising: selecting a logical data object from saidcommon pool; determining if said selected logical data object is a WORMlogical data object; determining if said selected WORM logical dataobject is available for reuse for reuse as a new WORM logical dataobject; maintaining data attributes bound to said selected WORM logicaldata object until it is determined if said selected WORM logical dataobject is available for reuse; assigning at least one temporary dataattribute to said selected WORM logical data object while maintainingsaid data attributes bound to said selected WORM logical data object;and mounting said selected WORM logical data object and receiving awrite command from beginning of logical data object to bind at least onedata attribute to said selected WORM logical data object to replace dataattributes and data associated with said selected WORM logical dataobject to reuse said selected WORM logical data object as said new WORMlogical data object.
 15. The method of claim 14, further comprising: ifit is determined that said selected logical data object is a WORMlogical data object then; determining if said selected logical dataobject is a WORM logical data object for reuse as a new read-writelogical data object; maintaining data attributes bound to said selectedWORM logical data object until it is determined that said selected WORMlogical data object is available for reuse; assigning at least onetemporary data attribute to said selected WORM logical data object whilemaintaining said data attributes bound to said selected WORM logicaldata object; and mounting said selected WORM logical data object andreceiving a write command from beginning of logical data object toremove data attributes and data associated with said selected WORMlogical data object to reuse said selected WORM logical data object assaid new read-write logical data object.
 16. The method of claim 14,further comprising: if it is determined that said selected logical dataobject is a read-write logical data object then; determining if saidselected read-write logical data object is a read-write logical dataobject for reuse as a new WORM logical data object; maintaining dataassociated with said selected read-write logical data object until it isdetermined that said selected read-write logical data object isavailable for reuse; assigning at least one temporary data attribute tosaid selected read-write logical data object while maintaining said dataassociated with said selected read-write logical data object; andmounting said selected read-write logical data object and receiving awrite command from beginning of logical data object to bind at least onedata attribute to said selected read-write logical data object toreplace data associated with said selected read-write logical dataobject to reuse said selected read-write logical data object as said newWORM logical data object.
 17. The method of claim 14, furthercomprising: providing said at least one temporary data attributeassigned to said selected WORM logical data object to said processorduring said mounting of said selected WORM logical data object;determining if said selected WORM logical data object is available forreuse as said new WORM logical data object by issuing said write commandto beginning of logical data object; and if said write command tobeginning of logical data object is not issued, retaining said dataassociated with said selected WORM logical data object and said dataattributes bound to said WORM logical data object and discarding saidtemporary data attributes.
 18. The method of claim 13, wherein saidcommon pool comprises scratch logical data objects, said scratch logicaldata objects comprising at least one WORM logical data object and atleast one read-write logical data object.
 19. The method of claim 18,wherein reuse of said logical data object can only occur if said logicaldata object is selected from a pool of scratch said logical data objectsor if said logical data object is a logical data object that is newlyinserted in the virtual server.
 20. The method of claim 19, whereinreuse one of said scratch logical data object occurs only in response tosaid processor cycling said scratch logical data object through saidscratch pool as a selected scratch logical data object.
 21. The methodof claim 19, wherein said scratch logical data object is moved to a saidpool of scratch logical data objects only if said processor hasdetermined that the data stored thereon has expired and said scratchlogical data object is available for reuse.
 22. A computer programproduct, comprising: a computer usable medium having computer usableprogram code embodied therewith, the computer usable program codecomprising: computer usable program code configured to operate aprocessor to operate a virtual server configured to support at least oneWrite Once Read Many (WORM) logical data object and at least oneread-write logical data object; computer usable program code configuredto initialize said logical data object from said common pool of saidlogical data objects, said logical data object bound with a member of amedia type group in response to said write to said beginning of saidlogical data object to replace said any information previouslyassociated with said logical data object, said member of said media typegroup comprising a WORM data object and a read-write data object; andcomputer usable program code configured to reuse one of said logicaldata objects as said member of said media type group without ejectionand reinsertion by mounting said logical data object with a write frombeginning of said logical data object to bind at least one dataattribute to said member of said media type group to replace anyprevious attribute and data associated with said logical data object 23.The computer program product of claim 22, wherein said computer usableprogram code configured to initialize further comprises: computer usableprogram code configured to operate said processor to select one of saidWORM logical data objects for reuse as a new WORM logical data object,said processor maintaining data attributes bound to said selected WORMlogical data object until it is determined that said selected WORMlogical data object is available for reuse; computer usable program codeconfigured operate said processor to select one of said WORM logicaldata objects for reuse as a new WORM logical data object, said processormaintaining data attributes bound to said selected WORM logical dataobject until it is determined that said selected WORM logical dataobject is available for reuse; computer usable program code configuredto operate said processor to assign at least one temporary dataattribute to said selected WORM logical data object while maintainingsaid data attributes bound to said selected. WORM logical data object;and computer usable program code configured to operate said processor tomount said selected WORM logical data object and receive a write commandfrom beginning of logical data object to bind at least one dataattribute to said selected WORM logical data object to replace dataattributes and data associated with said selected WORM logical dataobject to reuse said selected WORM logical data object as said new WORMlogical data object.
 24. The computer program product of claim 23,further comprising: computer usable program code configured to operatesaid processor to select one of said WORM logical data objects for reuseas a new read-write logical data object, said processor maintaining dataattributes bound to said selected WORM logical data object until it isdetermined that said selected WORM logical data object is available forreuse; computer usable program code configured to operate said processorto assign at least one temporary data attribute to said selected WORMlogical data object while maintaining said data attributes bound to saidselected WORM logical data object; and computer usable program codeconfigured to operate said processor to mount said selected WORM logicaldata object and receive a write command from beginning of logical dataobject to remove data attributes and data associated with said selectedWORM logical data object to reuse said selected WORM logical data objectas said new read-write logical data object.
 25. The computer programproduct of claim 23, further comprising: computer usable program codeconfigured to operate said processor to select one of said read-writelogical data objects for reuse as a new WORM logical data object, saidprocessor maintaining data associated with said selected read-writelogical data object until it is determined that said selected read-writelogical data object is available for reuse; computer usable program codeconfigured to operate said processor to assign at least one temporarydata attribute to said selected read-write logical data object whilemaintaining said data associated with said selected read-write logicaldata object; and computer usable program code configured to operate saidprocessor to mount said selected read-write logical data object andreceiving a write command from beginning of logical data object to bindat least one data attribute to said selected read-write logical dataobject to replace data associated with said selected read-write logicaldata object to reuse said selected read-write logical data object assaid new WORM logical data object.
 26. The computer program product ofclaim 23, further comprising: computer usable program code configured toprovide said at least one temporary data attribute assigned to saidselected WORM logical data object to said processor during said mountingof said selected WORM logical data object; computer usable program codeto operate said processor to determine if said selected WORM logicaldata object is available for reuse as said new WORM logical data objectby issuing said write command to beginning of logical data object; andif said write command to beginning of logical data object is not issued,said data associated with said selected WORM logical data object andsaid data attributes bound to said WORM logical data object are retainedand said temporary data attributes are discarded.
 27. A virtual serversupporting at least one Write Once Read Many (WORM) logical data objectand at least one read-write logical data object, the virtual servercomprising: a processor configured to select one of a WORM logical dataobject and a read-write logical data object for reuse as a new WORMlogical data object, said processor maintaining data attributes bound tosaid selected logical data object until it is determined that saidselected logical data object is available for reuse; said processorassigning at least one temporary data attribute to said selected logicaldata object while maintaining said data attributes bound to saidselected logical data object; and said processor mounting said selectedlogical data object and receiving a write command from beginning oflogical data object to bind at least one data attribute to said selectedlogical data object to replace data attributes and data associated withsaid selected logical data object to reuse said selected logical dataobject as said new WORM logical data object.
 28. The virtual server ofclaim 27, further comprising: said processor selecting one of said WORMlogical data objects for reuse as a new WORM logical data object, saidprocessor maintaining data attributes bound to said selected WORMlogical data object until it is determined that said selected WORMlogical data object is available for reuse; said processor assigning atleast one temporary data attribute to said selected WORM logical dataobject while maintaining said data attributes bound to said selectedWORM logical data object; and said processor mounting said selected WORMlogical data object and receiving a write command from beginning oflogical data object to bind at least one data attribute to said selectedWORM logical data object to replace data attributes and data associatedwith said selected WORM logical data object to reuse said selected WORMlogical data object as said new WORM logical data object.
 29. Thevirtual server of claim 27, further comprising: said processor selectingone of said read-write logical data objects for reuse as a new WORMlogical data object, said processor maintaining data associated withsaid selected read-write logical data object until it is determined thatsaid selected read-write logical data object is available for reuse;said processor assigning at least one temporary data attribute to saidselected read-write logical data object while maintaining said dataassociated with said selected read-write logical data object; and saidprocessor mounting said selected read-write logical data object andreceiving a write command from beginning of logical data object to bindat least one data attribute to said selected read-write logical dataobject to replace data associated with said selected read-write logicaldata object to reuse said selected read-write logical data object assaid new WORM logical data object.